<!DOCTYPE html>
<html>
<style>
.fixedPosition { position: fixed; }
.runIn:nth-last-of-type(2n+1) { display: run-in; }
.transformed { float: none; transform: skewX(45deg); }
.floatLastChild:last-child { display: inline-block; float: left;}
</style>
<script>
if (window.testRunner) {
testRunner.waitUntilDone();
testRunner.dumpAsText();
}
var tableElement, liElement, formElement, buttonElement, fieldsetElement, labelElement, insElement;
function crash() {
tableElement = document.createElement('table');
tableElement.setAttribute('class', 'runIn');
document.documentElement.appendChild(tableElement);
liElement = document.createElement('li');
liElement.setAttribute('class', 'transformed');
document.documentElement.appendChild(liElement);
formElement = document.createElement('form');
formElement.setAttribute('class', 'floatLastChild');
buttonElement = document.createElement('button');
buttonElement.setAttribute('class', 'floatLastChild');
tableElement.appendChild(buttonElement);
fieldsetElement = document.createElement('fieldset');
labelElement = document.createElement('label');
insElement = document.createElement('ins');
insElement.setAttribute('class', 'fixedPosition');
tableElement.appendChild(formElement);
document.documentElement.offsetTop; // force a layout
buttonElement.appendChild(insElement);
document.documentElement.offsetTop; // force a layout
liElement.appendChild(fieldsetElement);
document.documentElement.offsetTop; // force a layout
labelElement.appendChild(formElement);
}
function removeContent() {
document.body.innerHTML = "Tests that lists in the rendering tree that track positioned objects are kept properly up-to-date through re-layout. <br />\
PASS. WebKit didn't crash.";
if (window.testRunner)
testRunner.notifyDone()
}
window.addEventListener('load', removeContent, false);
document.addEventListener('DOMContentLoaded', crash, false);
</script>
<body>
</body>
</html>
Codebase Browser
chromium